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IN THE CLAIMS : 

Please amend the claims as follows: 

1. (Currently Amended) A method for dynamic rules-based peg counting 
comprising: 

(a) at a plurality of signaling message site collectors, generating peg counter 
instances by comparing monitored signaling messages received bv the 
site collectors to existing peg counter definitions, each peg counter 
instance including an accumulator value indicating a number of the 
signaling messages that match one of the existing peg counter definitions 
and an identifier for identifying the associated peg counter definition; 

(b) receiving new peg counter definitions; and 

(c) in response to receiving the new peg counter definitions, switching to the 
new peg counter definitions on the fly and generating peg counter 
instances based on the new peg counter definitions. 

2. (Original) The method of claim 1 wherein generating peg counter instances 
includes: 

(a) determining whether a monitored signaling message matches one of the 
peg counter definitions; 

(b) in response to determining that a monitored signaling message matches 
one of the peg counter definitions, determining whether a peg counter 
instance exists for the matching peg counter definition; and 
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(c) in response to determining that a peg counter instance exists, 
incrementing an accumulator value associated with the peg counter 
instance. 

3. (Original) The method of claim 2 comprising, in response to determining that a 
peg counter instance does not exist, creating a new peg counter instance for the 
matching peg counter definition and incrementing an accumulator value 
associated with the peg counter instance. 

4* (Original) The method of claim 2 wherein determining whether a peg counter 
instance exists includes determining a peg counter identifier corresponding to the 
matching peg counter definition and searching for a peg counter instance having 
the peg counter identifier. 

5. (Original) The method of claim 1 wherein the peg counter definitions include 
rules for generating peg counter instances based on SS7 messages. 

6. (Original) The method of claim 1 wherein the peg counter definitions include 
rules for generating peg counter instances based on Internet Engineering Task 
Force SIGTRAN signaling messages. 

7. (Original) The method of claim 1 wherein the peg counter definitions include 
rules for generating peg counter instances based on IP telephony signaling 
messages. 

8. (Original) The method of claim 1 comprising creating the new peg counter 
definitions using a rules-based language. 

9. (Original) The method of claim 8 wherein creating the new peg counter 
definitions using a rules-based language includes presenting a user with lists of 
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messages and message parameters and receiving input from the user regarding 
messages, message parameters, and values for the message parameters. 

10. (Original) The method of claim 9 wherein creating the new peg counter 
definitions using a rules-based language includes presenting the user with 
comparator choices for comparing the message parameters to the message 
parameter values to create message parameter comparison equations and 
presenting the user with logical operators for combining the message parameter 
comparison equations and thereby creating a peg counter definition. 

11. (Original) The method of claim 1 wherein receiving the new peg counter 
definitions includes: 

(a) writing the new peg counter definitions to a database at an administration 
server; 

(b) downloading the peg counter definitions to databases at the site 
collectors; 

(c) notifying the site collectors of a change in their respective databases; and 

(d) at the site collectors, in response to receiving the notification, loading the 
new peg counter definitions into program memory. 

12. (Original) The method of claim 1 wherein switching to the new peg counter 
definitions on the fly includes switching to the new peg counter definitions without 
modifying or re-compiling computer code executing on the site collectors for 
generating the peg counter instances. 

13. (Original) The method of claim 1 comprising transmitting the peg counter 
instances from the site collectors to a data gateway server. 
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14. (Original) The method of claim 13 comprising, at the data gateway server, 
aggregating the peg counter instances from the site collectors to form system 
wide peg counter instances. 

15. (Original) The method of claim 14 wherein aggregating the peg counter 
instances includes: 

(a) receiving a first peg counter instance from a first site collector, the first peg 
counter instance having a first peg counter identifier, a first timestamp, 
and a first accumulator value; 

(b) searching for a peg counter instance having the first peg counter identifier 
and the first timestamp; and 

(c) in response to locating a peg counter instance having the first peg counter 
identifier and the first timestamp, adding the first accumulator value to an 
accumulator value associated with the peg counter instance. 

16. (Original) The method of claim 15 comprising, in response to failing to locate a 
peg counter instance having the first peg counter identifier and the first 
timestamp, storing the first peg counter instance as a new peg counter instance 
in a peg counter database. 

17. (Currently Amended) A system for dynamic rules-based peg counting, the 
system comprising: 

(a) a plurality of site collectors for receiving signaling messages and for 
generating peg counter instances based on the signaling messages 
matching existing peg counter definitions, the peg counter instances each 
including an accumulator value indicating a number of the received 

-5- 

PAGE 11/24 1 RCVDAT 3/8/2005 4:34:43 PM [Eastern Standard Time] 1 SVR:USPTO-EFXRF-6/16* DNIS:2738300 * CS1D: * DURATION (mm-ss):04<52 



MAR. 8.2006 4:37PM JENKINS, W I L SON&TAYLOR NO. 5357 P. 12 

Serial No.: 10/797,415 

signaling messages matching one of the peg counter definitions and an 
identifier for identifying the associated peg counter definition; and 
(b) an administration server operatively associated with the site collectors for 
receiving new peg counter definitions from a user and for communicating 
the new peg counter definitions to the site collectors, wherein, in response 
to receiving the new peg counter definitions, the site collectors are 
adapted to switch to the new peg counter definitions on the fly and to 
generate peg counter instances based on the new peg counter definitions. 

18. (Original) The system of claim 17 wherein the site collectors are adapted to 
generate peg counter instances based on SS7 signaling messages sent over 
SS7 signaling links. 

19. (Original) The system of claim 17 wherein the site collectors are adapted to 
generate peg counter instances based on Internet Engineering Task Force 
SIGTRAN signaling messages sent over IP signaling links. 

20. (Original) The system of claim 17 wherein the site collectors are adapted to 
generate peg counter instances based on IP telephony signaling messages sent 
over IP signaling links. 

21. (Original) The system of claim 17 wherein the site collectors are adapted to 
receive the signaling messages from signaling link probes. 

22. (Currently Amended) The system of claim 17 wherein the site collectors are 
adapted to receive the signaling messages [[form]] from message copy functions 
internal to a signaling node. 
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23. (Original) The system of claim 17 wherein the administration server is adapted to 
provide a rules-based language to the user for creating the peg counter 
definitions. 

24. (Original) The system of claim 23 wherein the rules-based language includes 
message type identifiers, message parameter identifiers, comparators for 
creating message parameter comparison equations, and logical operators for 
combining the message parameter comparison equations, 

25. (Original) The system of claim 17 wherein the administration server is adapted to 
download the new peg counter definitions to the site collectors and notify the site 
collectors of the presence of the new peg counter definitions. 

26. (Original) The system of claim 17 comprising a data gateway server operatively 
associated with the site collectors and a plurality of applications, wherein the site 
collectors are adapted to upload the peg counter instances to the data gateway 
server at predetermined intervals. 

27. (Original) The system of claim 26 wherein the data gateway server is adapted to 
aggregate the peg counter instances received from the site collectors and to 
generate application-specific peg counter instances in response to application- 
specific peg counter requests. 

28. (Currently Amended) A computer program product comprising computer 
executable instructions embodied in a computer readable medium for performing 
steps comprising: 
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(a) presenting the user with a computer based graphical template for defining 
a peg counter for counting signaling messages received by a site 
collector ; 

(b) receiving input from the user via the template regarding parameter values 
to be extracted from the received signaling messages; 

(c) receiving input from the user via the template regarding values to be 
compared with the extracted parameter values; 

(d) receiving input from the user via the template regarding equations for 
comparing the extracted parameter values to the values specffied in step 
(c)[[]]; and 

(e) receiving input from the user via the template regarding logical operators 
for combining equations to form a definition for the peg counter. 

29. (Original) The computer program product of claim 28 wherein presenting the 
user with a computer based graphical template for defining a peg counter 
includes presenting the user with a computer based graphical template including 
menus for selecting the parameters and logical operators. 

30. (Original) The computer program product of claim 28 wherein receiving input 
from the user regarding parameter values to be extracted from received 
messages includes presenting the user with a menu of parameter names 
corresponding to a message type for the peg counter and allowing the user to 
select parameter names from the list 

31. (Original) The computer program product of claim 28 wherein receiving input 
from the user regarding parameter values to be compared with the extracted 
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parameter values includes presenting the user with an input field for allowing the 
user to input parameter values. 

32. (Original) The computer program product of claim 28 wherein receiving input 
from the user regarding parameter values to be compared with the extracted 
parameter values includes presenting the user with a menu of parameter value 
lists and receiving input from the user regarding one of the parameter value lists, 

33. (Original) The computer program product of claim 28 wherein receiving input 
from the user regarding equations includes presenting the user with a menu of 
comparators and allowing the user to select comparators from the menu. 

34. (Original) The computer program product of claim 28 wherein receiving input 
from the user regarding logical operators includes presenting the user with a 
menu including AND-based and OR-based operators and receiving input from 
the user regarding operators for combining the equations. 

35. (Original) The computer program product of claim 28 comprising storing the peg 
counter definition in a database. 

36. (Original) The computer program product of claim 28 comprising distributing the 
peg counter definition from an administration server to a plurality of network 
monitoring site collectors. 

37. (Original) The computer program product of claim 36 comprising notifying the 
site collectors of the peg counter definition. 

38. (New) The method of claim 1 wherein the signaling messages received by the 
site collectors comprise signaling messages copied by at least one of link 
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monitors internal to signaling nodes and link monitors external to the signaling 
nodes. 

39. (New) The system of claim 17 wherein the signaling messages received by the 
site collectors comprise signaling messages copied by at least one of link 
monitors internal to signaling nodes and link monitors external to the signaling 
nodes. 

40. (New) The computer program product of claim 28 wherein the received signaling 
messages comprise signaling messages copied by at Jeast one of link monitors 
internal to signaling nodes and link monitors external to the signaling nodes. 
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